Document that interpolating a '(??{ code })' construct in a regular

expression also requires "use re 'eval'", just as '(?{ code })' does.

diff --git a/ext/re/re.pm b/ext/re/re.pm
index 5701601..02393ce 100644 (file)
--- a/ext/re/re.pm
+++ b/ext/re/re.pm
@@ -203,11 +203,13 @@ other transformations.
 =head2 'eval' mode
 
 When C<use re 'eval'> is in effect, a regexp is allowed to contain
-C<(?{ ... })> zero-width assertions even if the regular expression contains
+C<(?{ ... })> zero-width assertions and C<(??{ ... })> postponed
+subexpressions, even if the regular expression contains
 variable interpolation.  That is normally disallowed, since it is a
 potential security risk.  Note that this pragma is ignored when the regular
 expression is obtained from tainted data, i.e.  evaluation is always
-disallowed with tainted regular expressions.  See L<perlre/(?{ code })>.
+disallowed with tainted regular expressions.  See L<perlre/(?{ code })> 
+and L<perlre/(?{ code })>.
 
 For the purpose of this pragma, interpolation of precompiled regular
 expressions (i.e., the result of C<qr//>) is I<not> considered variable
@@ -216,7 +218,7 @@ interpolation.  Thus:
     /foo${pat}bar/
 
 I<is> allowed if $pat is a precompiled regular expression, even
-if $pat contains C<(?{ ... })> assertions.
+if $pat contains C<(?{ ... })> assertions or C<(??{ ... })> subexpressions.
 
 =head2 'debug' mode
 

diff --git a/pod/perlre.pod b/pod/perlre.pod
index e040f09..c997a9e 100644 (file)
--- a/pod/perlre.pod
+++ b/pod/perlre.pod
@@ -1035,6 +1035,12 @@ The following pattern matches a parenthesized group:
 See also C<(?PARNO)> for a different, more efficient way to accomplish
 the same task.
 
+For reasons of security, this construct is forbidden if the regular
+expression involves run-time interpolation of variables, unless the
+perilous C<use re 'eval'> pragma has been used (see L<re>), or the
+variables contain results of C<qr//> operator (see
+L<perlop/"qr/STRING/imosx">).
+
 Because perl's regex engine is not currently re-entrant, delayed
 code may not invoke the regex engine either directly with C<m//> or C<s///>),
 or indirectly with functions such as C<split>.